EUVD-2026-54263
GHSA-5wvw-hxfh-pcqr
Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
AC:H reflects the mandatory renderer-compromise prerequisite; S:C and C/I/A:H reflect full OS-level impact after sandbox escape; PR:N because no system authentication is required of the victim.
Primary rating from Vendor (google).
CVSS VectorVendor: google
Lifecycle Timeline
3DescriptionCVE.org
Use after free in WebGL in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)
AnalysisAI
Use-after-free in the WebGL subsystem of Google Chrome for Android (prior to 151.0.7922.109) enables sandbox escape for an attacker who has already achieved renderer-process compromise. By directing a victim to a crafted HTML page, an adversary with existing renderer access can exploit freed memory corruption in WebGL to break out of Chrome's sandbox and reach OS-level execution on the Android device. No public exploit code or active exploitation has been identified; SSVC rates exploitation as none and automatable as no, though technical impact is assessed as total given the full scope change.
Technical ContextAI
WebGL (Web Graphics Library) is a JavaScript API exposed to web content for GPU-accelerated 3D rendering, implemented within Chrome's renderer process. CWE-416 (Use After Free) arises when a memory object is freed but a dangling pointer to it is subsequently dereferenced, allowing heap layout manipulation to redirect execution. Chrome's multi-process sandbox isolates renderer content from the browser process and OS, but a UAF in a privileged GPU/graphics code path can provide the primitive needed to subvert that isolation. The vulnerability is specific to Chrome's Android implementation, suggesting the Android-specific WebGL or GPU driver integration path contains the defect. Affected version range per EUVD-2026-54263: all Chrome releases below 151.0.7922.109.
RemediationAI
Update Google Chrome on Android to version 151.0.7922.109 or later; this is the vendor-released patch as documented in the Chrome stable channel update advisory at https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_01193673229.html. Chrome on Android typically auto-updates via the Google Play Store, but enterprise administrators managing Android fleets via MDM or EMM solutions (e.g., Android Enterprise) should validate patch deployment and enforce minimum version policy. As a compensating control prior to patching, disabling WebGL via Chrome enterprise policy (setting the WebGLEnabled policy to false, or toggling chrome://flags/#disable-webgl on unmanaged devices) eliminates the vulnerable attack surface at the cost of breaking WebGL-dependent web applications. This workaround is impactful for environments relying on web-based 3D content but is effective at removing the attack vector.
Same weakness CWE-416 – Use After Free
View allSame technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: CriticalShare
External POC / Exploit Code
Leaving vuln.today